PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-11065 Red Hat CVE debrief

CVE-2025-11065 is a medium-severity vulnerability in the github.com/go-viper/mapstructure/v2 package. The flaw is located in the field processing component using mapstructure.WeakDecode, which allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts. The vulnerability was published on January 26, 2026, and last modified on June 25, 2026. The CVSS score is 5.3, indicating a medium severity level. The vulnerability is related to CWE-209. There are multiple sources referencing this vulnerability, including Red Hat and GitHub.

Vendor
Red Hat
Product
OpenShift Pipelines
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-26
Original CVE updated
2026-06-30
Advisory published
2026-01-26
Advisory updated
2026-06-30

Who should care

Developers and security teams using the github.com/go-viper/mapstructure/v2 package should be aware of this vulnerability. The vulnerability allows information disclosure, which could potentially lead to security issues if exploited. Users of this package, especially those processing sensitive data, should take necessary precautions to mitigate the risk.

Technical summary

The vulnerability is caused by the mapstructure.WeakDecode function in the github.com/go-viper/mapstructure/v2 package. This function processes user-supplied data and generates detailed error messages that may contain sensitive information. An attacker could potentially exploit this vulnerability by providing malformed data to leak sensitive information. The vulnerability has a CVSS score of 5.3 and is classified as CWE-209. The affected package is widely used in Go applications for decoding and mapping data.

Defensive priority

This vulnerability should be prioritized for remediation, especially in applications handling sensitive data. The risk of information disclosure is medium, but the potential impact could be significant depending on the context in which the vulnerable package is used.

Recommended defensive actions

  • Review and update github.com/go-viper/mapstructure/v2 to the latest version.
  • Implement input validation and sanitization for data processed by the mapstructure.WeakDecode function.
  • Configure logging to avoid leaking sensitive information in error messages.
  • Monitor applications using the vulnerable package for potential security incidents.
  • Consider using alternative packages or versions that are not vulnerable.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Red Hat and GitHub also reference this vulnerability, indicating potential impact on related products and projects. However, specific details about affected products and versions are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-11065 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-11065

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-11065 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-11065

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.